WebApp Sec: Re: code analysis for c#?

[Mads Rasmussen <mads () opencs com br>]

Thanks Thomas,

As I said before, I found the output of 
http://ivanz.webpark.cz/codeanalyzer.html
better than FxCop, might be slightly limited in funcionality though.

Regarding comercial tools, I am currently investigating Sanctums AppScan 
, the developer edition as well as Total .Net Analyzer
http://www.fmsinc.com/dotnet/analyzer/index.asp

That one is really cool, it comes as a plugin for VS and analyzes as you 
code or after. It shows stuff that FxCop cannot find due to its 
architecture of looking at the metatags of compiled code, where Total 
Analyzer looks at the source code directly.
It seems that the trial version is limited though, I expected to find 
more errors than it came up with, something I still have to confirm if I 
would choose to buy the tool.
Thanks for the input from all of you btw, let's broaden the knowledge of 
these tools !
Regards,

Mads

Cassidy, Thomas wrote:
> One of the drawbacks to FxCop is that it will not let you look at code
> inside functions, i.e., you can only apply it's rules to globals and
> function declarations.
>
> We are investigating a tool named Code Auditor from SSW (www.ssw.com)
> that allows you to build your code analysis rules using regular
> expressions.
>
> Tom